The present invention relates to data communications and more particularly is concerned with techniques for the authentication both of messages flowing across a communications network and of their senders--factors of great importance e.g. in the field of electronic funds-transfer and for other systems carrying financial or other commercially-sensitive information.
In such systems it is clearly important to be able to detect at the receiving end any active attack upon, or other corruption of, a message which might have taken place in the course of its transmission across the network. An active attack might take the form of an interceptor adding, removing or altering information in the message with criminal or vexatious intent. While it may be almost impossible to prevent an active attack there are various mechanisms which aim to ensure that such an attack will be detected and hence can be rendered nugatory. The most common depends upon the generations prior to transmission, of a cryptographic check-sum or message authentication code--termed herein an "authenticator" --from the information contained in the message, which is then appended to the message for transmission. The theory underlying this approach is that if the recipient himself computes the expected authenticator from the message as received using the same cryptographic transformation, and finds it to disagree with the authenticator actually received with the message, then he will know that the message has been altered in some way. If on the other hand the expected and received authenticators match then he knows with a high degree of probability that the message has not been altered, that probability increasing with the length of the authenticator. An example of this in common usage is the system described in American National Standards Institute (ANSI) standards X9.9 and X9.19. Within these standards the cryptographic algorithm is the Data Encryption Algorithm as described in ANSI X3.92, the cryptographic key is a 56-bit DEA key and the authenticator is a 32-bit value appended to the message.
The success of such a system of message authentication of course depends on maintaining the secrecy of the cryptographic key from would-be interceptors. In any such system the same key must, however, be known to, or at least available for the computation of authenticators by, both the sender and recipient. In known systems this raises the possibility that one user might impersonate another and, since the foregoing possibility exists, that a user might attempt to repudiate a genuine transaction. That is to say, while a recipient may be certain from the contents of a received authenticator that any given message was received in the form in which it was originally sent, the authenticator itself cannot guarantee that the sender was the person whom the message purports it to be because the same authenticator generating key is available to all users.